Check Point links three intrusion clusters to suspected supplier CopperDragon
Original title: Suspected Chinese Malware Supplier Tied to Three Hacking Campaigns
SilentDelivery, OceanGate, and DarkWire share Sparrow code or infrastructure across Latin America, Asia, and Europe.
Check Point Research tied SilentDelivery, OceanGate, and DarkWire to shared Sparrow framework features and named a suspected supplier, CopperDragon. The year-long review covered campaigns against several dozen high-profile organizations. SilentDelivery used compromised sites and a fake certificate utility; OceanGate moved from a Linux server into Windows; DarkWire hit telecom operators and government bodies. CPR also linked the framework to FamousSparrow and said related groups may share a toolset.
Unconfirmed: CopperDragon is a suspected supplier; the Salt Typhoon relationship is unclear, and DarkWire lacks direct code overlap.
- SilentDelivery, seen since early 2026, delivered SquadC or a SparrowDoor variant via a fake certificate fix.
- OceanGate, observed in 2025 and 2026, targeted Asian government and critical-infrastructure organizations.
- DarkWire hit telecom operators, including at least three major providers, plus foreign affairs and justice bodies.
- CPR said CopperDragon may also supply Melofee variants; the Salt Typhoon relationship remains unclear.
- DarkWire’s link rests on a FamousSparrow-related domain, not direct code overlap.
Impact: Footholds, stolen credentials, and exfiltrated operational data
From the original article
2 min read at infosecurity-magazine.com
Check Point links three China-nexus clusters through a shared Sparrow malware framework
By Alessandro Mascellino · infosecurity-magazine.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.